CVE-2021-21551
KEVDell dbutil Driver Insufficient Access Control Vulnerability
Description
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HPublishedMay 4, 2021
Last modifiedJun 17, 2026
Added to KEVMar 31, 2022
Remediation dueApr 21, 2022
References
- packetstormsecurity.com/files/162604/Dell-DBUtil_2_3.sys-IOCTL-Memory-Read-Write.htmlExploitThird Party Advisory
- packetstormsecurity.com/files/162739/DELL-dbutil_2_3.sys-2.3-Arbitrary-Write-Privilege-Escalation.htmlExploitThird Party Advisory
- dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerabilityMitigationVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21551US Government Resource
0 recent articles mention this CVE
82
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1649 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 79.6% · top 1% of all CVEs
- Weakness
- CWE-782
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.